Sandboxie Forum - Set a limit to the number of sandboxed processes (6598)

tzuk:

Mon Mar 15, 2010 5:45 pm

At some point, sure.

Cisqo:

Mon Mar 15, 2010 4:20 pm

Thanks alot Tzuk! do you plan on extending the GUI to allow modification of these setting?

Buster:

Thu Mar 11, 2010 8:41 pm

]]>Quoting tzuk: ]]>Creative values can turn off one or both modes. For example, ProcessLimit2=999999 will effectively disable the termination feature. Whereas, ProcessLimit1=50 ProcessLimit2=50 Will effectively disable the delaying feature. ]]> Ok, this solve my doubts. :wink:

tzuk:

Thu Mar 11, 2010 8:17 pm

Yes, with sufficiently large default values that it shouldn't interfere with your day-to-day use, and might actually be useful when you run across a program that spawns itselfs endlessly.

Ruhe:

Thu Mar 11, 2010 8:16 pm

]]>Quoting tzuk: ]]>The default numbers are 100 and 200 ]]> So this whole feature is enabled by default?

tzuk:

Thu Mar 11, 2010 8:03 pm

Earlier, I said, ]]>Quoting tzuk: ]]>I might be able to introduce small delays when a lot of programs are created during a short period of time. But I should tell you, I am not considering this a top priority. ]]> I tried this approach but I couldn't get it to work well in practice. Whatever value I used for "maximum of programs at once", it meant that this many programs at once can spawn multiple copies of themselves. The end result was always an unmanageable system. The hard limit approach turns out to work much better, so version 3.45.01 introduces two new settings: ProcessLimit1=100 ProcessLimit2=200 Once the sandbox has more than X programs at the same time, each new program will be delayed for ten seconds before it starts to run. (X is the number specified in ProcessLimit1.) Once the sandbox has more than Y programs at the same time, each new program will be immediately terminated. (Y is the number specified in ProcessLimit2.) The default numbers are 100 and 200 as mentioned above. ProcessLimit2 cannot be smaller than ProcessLimit1. Creative values can turn off one or both modes. For example, ProcessLimit2=999999 will effectively disable the termination feature. Whereas, ProcessLimit1=50 ProcessLimit2=50 Will effectively disable the delaying feature.

Buster:

Thu Feb 04, 2010 5:40 pm

Maybe in 3.45.xx :wink:

ssj100:

Wed Dec 02, 2009 11:04 pm

An interesting request, but one that I'm not fussed about. Almost all my sandboxes have start/run restrictions in place anyway, meaning only the processes I choose are allowed to start/run.

Dimmu: Hardlimit more practical

Wed Dec 02, 2009 7:14 pm

Setting a hard limit is a good thing though, becuase for the casual user, surfing the web may not take notice if the malware that slips through starts initiating a huge number of processes even at a slower rate (due to the intentional delay system you will introduce. ) I see the usefulness of it when intentionally testing a POC, but most people dont tend to check the sandboxie control until the end of their browsing sesssion, even if that. Of course Im not aware, but if doing so will lead to technical barriers in order to put such a restriction in place, then please tell us.

Buster:

Wed Dec 02, 2009 7:14 am

Will you include this feature in 3.43.x betas?

tzuk:

Sun Nov 08, 2009 1:28 pm

Oh, no need for that. A batch file that spawns two instances of itself should be enough, and would be trivial to create.

Buster:

Sun Nov 08, 2009 1:12 pm

I will find an example you can use to work with.

Buster:

Sun Nov 08, 2009 1:08 pm

That sounds good enough, thanks!

tzuk:

Sun Nov 08, 2009 12:59 pm

OK, maybe no need for a hard limit: I might be able to introduce small delays when a lot of programs are created during a short period of time. But I should tell you, I am not considering this a top priority.

Buster:

Sun Nov 08, 2009 12:48 pm

I meant malwares that create tons of processes to try to collapse the system. Being able to set a limit to sandboxed processes would "fix" that problem when processing such malwares.

tzuk:

Sun Nov 08, 2009 12:45 pm

I don't understand. That other topic says a program (which happens to be sandboxed, but not necessarily) can't be terminated while csrss.exe is displaying a message box on behalf of that program. How is limiting the number of programs running in a sandbox at any one time going to help with that?

Buster:

Sun Nov 08, 2009 11:49 am

http://sandboxie.com/phpbb/viewtopic.php?t=3250

tzuk:

Sun Nov 08, 2009 1:04 am

I guess I'm curious.

Buster:

Sun Nov 08, 2009 12:00 am

If the answer is no, why to explain the use of that? :D

tzuk:

Sat Nov 07, 2009 9:52 pm

No. What would be the use of that?

Buster: Set a limit to the number of sandboxed processes

Sat Nov 07, 2009 8:52 am

tzuk: Would be possible to add a feature to set a limit to the number of sandboxed processes?